seisin 0.5.0 → 0.6.0

package/src/views.js

@@ -9,16 +9,22 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { explain, standingOf } from "./owners.js";
-import { kindsOf, KINDS } from "./kinds.js";
+import { kindsOf, KINDS, expectedOf } from "./kinds.js";
 import { walls } from "./walls.js";
-import { pending, requestsPath, markStale } from "./requests.js";
+import { queueOf } from "./requests.js";
 
 /**
  * An ISO date from what a person or an agent typed, or null for no filter.
- * Anything that does not parse is ignored rather than refused: a bad filter
- * should show everything, not an error.
+ *
+ * A date (`2026-10-01`, any ISO time) or a duration back from `now`: `7d`,
+ * `12h`, `2w`, `30m` (minutes — a month is not a fixed length). Anything that
+ * does not parse is null; the MCP ignores it rather than refusing (a bad filter
+ * should show everything, not an error), and the CLI says so instead.
  */
-export function parseSince(raw) {
+const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000, w: 7 * 86_400_000 };
+export function parseSince(raw, now = Date.now()) {
+  const d = /^\s*(\d+)\s*([mhdw])\s*$/i.exec(String(raw ?? ""));
+  if (d) return new Date(now - Number(d[1]) * UNIT_MS[d[2].toLowerCase()]).toISOString();
   const t = raw ? Date.parse(raw) : NaN;
   return Number.isNaN(t) ? null : new Date(t).toISOString();
 }
@@ -69,7 +75,7 @@ export function verdicts(cfg, { now = Date.now() } = {}) {
  * hundred identical rows instead of one sentence. Grouped, the shape of the
  * day is visible at a glance and it is almost never a territory dispute.
  *
- * `stillRefused` is recomputed against the policy as it stands, not read out
+ * `stillDenied` is recomputed against the policy as it stands, not read out
  * of the log — a cause that has been granted since is history, not friction,
  * and leaving it on the page sends somebody to fix what is already fixed.
  */
@@ -77,6 +83,9 @@ export function causesOf(cfg, entries, { ask = explain, limit = 12 } = {}) {
   const by = new Map();
   for (const e of entries) {
     if (e.verdict !== "denied" || !e.target || !e.action) continue;
+    // A probe the caller of the run asked to be denied (`--expect-denied`):
+    // in the log, and not a cause of anything.
+    if (e.expected === true) continue;
     const k = `${e.action}\u0000${e.target}`;
     const g = by.get(k) ?? { action: e.action, target: e.target, kind: e.kind, times: 0, roles: new Set(), ownersThen: e.owners ?? [] };
     g.times++;
@@ -176,6 +185,19 @@ export function causesOf(cfg, entries, { ask = explain, limit = 12 } = {}) {
    * shows keys, network and tools apart from files: "no role owns this" is a
    * sentence about paths, and said of a port or a tool it is simply wrong.
    */
+  /**
+   * Refusals that are expected (kinds.js expectedOf) — Claude Code's plugin
+   * updater — counted apart so the page can say them as the boundary working
+   * rather than leave them at the top of the list as something to grant.
+   */
+  const expected = { paths: 0, denials: 0 };
+  for (const g of by.values()) {
+    g.expected = expectedOf(g.target);
+    if (!g.expected) continue;
+    expected.paths++;
+    expected.denials += g.times;
+  }
+
   const about = Object.fromEntries(ABOUT.map((k) => [k, { paths: 0, denials: 0 }]));
   for (const g of by.values()) {
     const a = aboutOf(g.kind);
@@ -188,6 +210,7 @@ export function causesOf(cfg, entries, { ask = explain, limit = 12 } = {}) {
     unowned: piles.unowned.paths,
     about,
     standing: piles,
+    expected,
     // The real number of distinct causes, not the length of the list below.
     // The page says "over N distinct paths" and the list is capped at twelve,
     // so taking N from the list reported the cap as if it were the count —
@@ -208,19 +231,20 @@ export function causesOf(cfg, entries, { ask = explain, limit = 12 } = {}) {
         ...(g.standing.why && { why: g.standing.why }),
         // Only on an unowned cause: what kind of thing it is, and what to do.
         ...(g.nature && { kind: g.nature.kind, hint: g.nature.hint }),
+        ...(g.expected && { expected: g.expected }),
         owners: g.standing.owners,
         ownersThen: g.ownersThen,
         // How many of the roles that hit this would still hit it. `some` and
         // not `every`: two roles out of three still blocked is still friction,
         // and requiring all of them would quietly retire a live cause the day
         // one role got a grant.
-        stillRefused: [...g.roles].filter((r) => cfg.roles[r] && !ask(cfg, r, g.action, g.target).allowed).length,
+        stillDenied: [...g.roles].filter((r) => cfg.roles[r] && !ask(cfg, r, g.action, g.target).allowed).length,
       })),
   };
 }
 
 /** What a log line was about. Lines from before the field existed are files. */
-const ABOUT = ["file", "key", "network", "tool"];
+const ABOUT = ["file", "key", "network", "system", "tool"];
 function aboutOf(kind) {
   return ABOUT.includes(kind) ? kind : "file";
 }
@@ -245,7 +269,8 @@ export function describeWalls(cfg, byRole, entries) {
   for (const [role, list] of Object.entries(byRole)) {
     out[role] = list.map((w) => {
       const about = aboutOf(kindOfLine.get(`${role}\u0000${w.action}\u0000${w.target}`));
-      const x = { ...w, about, retried: w.times - 1 };
+      // An expected wall (walls.js) is not the agent retrying anything.
+      const x = { ...w, about, retried: w.expected ? 0 : w.times - 1 };
       // Every file wall, owned or not: a protected path can also lie inside
       // someone's territory, and "owned" must not hide "never granted". The
       // owners are today's, as Denied's are.
@@ -280,10 +305,11 @@ export function wallsByRole(cfg, entries, { ask } = {}) {
 }
 
 /**
- * The request queue as a person should read it: pending, with the requests
- * the role has stopped asking for marked. `history` is the whole log, every
- * verdict — a run that was only allowed things is still a run.
+ * The request queue as a person should read it: pending, each with its handoff
+ * decided, and the requests the role has stopped asking for marked. `history`
+ * is the whole log, every verdict — a run that was only allowed things is
+ * still a run.
  */
-export function queue(root, history, keyDirs = null) {
-  return markStale(pending(requestsPath(root), { keyDirs }), history);
+export function queue(cfg, history, { readOnly = false } = {}) {
+  return queueOf(cfg, history, { readOnly });
 }

package/src/violations.js

@@ -38,16 +38,37 @@
  * reads paths out of the traced process's memory — its own comment calls those
  * events attacker-controlled and racy. That is not a stream an outside process
  * can attach to, and it is not one to reimplement. On Linux this returns an
- * unavailable watcher with the reason, and `seisin run` says so once.
+ * unavailable watcher with the reason. `seisin run` does not print it — once
+ * per run is a line nobody can act on — and `seisin check` says it, with the
+ * platform's other standing limits.
  */
 import { spawn, execFileSync } from "node:child_process";
 import { statSync } from "node:fs";
+import { basename } from "node:path";
 
 /** Only sandbox-runtime tags its violations this way. Everything else on the
  *  machine — Safari, mDNSResponder, Spotlight — is filtered out by the OS
  *  before a byte reaches us, which is why the predicate is not a grep. */
 const PREDICATE = 'eventMessage ENDSWITH "_SBX"';
 
+/**
+ * What `log stream` prints in place of the messages it could not keep up with.
+ *
+ * The one way this instrument loses a denial without anything else noticing:
+ * the kernel refuses, the agent sees EPERM, and the line never arrives. It
+ * happens when the unified log is flooded — measured, a network filter's
+ * kernel extension writing ~6,700 lines a second while it dropped two
+ * sessions' connections — and the predicate does not help, because the stream
+ * is dropped before it is filtered. The marker carries no count and no names:
+ * one line per batch lost, which is all there is to report.
+ */
+const DROPPED = /^=== Messages dropped during live streaming\b/gm;
+
+/** How many batches `log stream` says it dropped in this text. */
+export function droppedIn(text) {
+  return (String(text).match(DROPPED) ?? []).length;
+}
+
 /** `Sandbox: <proc>(<pid>) deny(<n>) <operation> <detail>` */
 const DENY = /Sandbox:\s+(\S+)\((\d+)\)\s+deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/;
 
@@ -82,9 +103,25 @@ export function actionOf(operation) {
   if (operation.startsWith("file-write")) return "write";
   if (operation === "file-read-data") return "read";
   if (operation === "network-outbound") return "connect";
+  if (SYSTEM.test(operation)) return "system";
   return null;
 }
 
+/**
+ * The operations that are neither a file nor a connection — `mach-register`,
+ * `mach-lookup`, `sysctl-read`, `iokit-open`… — and that used to be dropped.
+ *
+ * They were dropped as the sandbox doing its job against the machine, and most
+ * of them are: a browser asks for the window server and carries on. But one of
+ * them was the whole failure of a headless Chromium — a refused
+ * `mach-register` that killed the browser at start — and from seisin's record
+ * there was no way to know: five file reads in the log, and a crash. So they
+ * are recorded now, by operation and name, once per run each (intake.js), and
+ * never as a request: there is no territory to hand them to. What grants one
+ * is a preset like `browsers`, not `seisin grant`.
+ */
+const SYSTEM = /^(mach|sysctl|iokit|ipc|signal|process|system|user-preference|darwin|nvram|lsopen|appleevent)-/;
+
 /**
  * The target of a refused connection, or null when it is not one worth a line.
  *
@@ -139,6 +176,13 @@ export function parseChunk(chunk) {
     if (!target) return null;
     return { ...deny, action, path: target, suffix: tag?.suffix ?? null, command: tag?.command ?? null };
   }
+  // The name as the kernel gave it ("com.apple.tsm.portname (per-pid)"); an
+  // operation with no name is not a line anyone can act on.
+  if (action === "system") {
+    const name = deny.detail.trim();
+    if (!name) return null;
+    return { ...deny, action, path: name, suffix: tag?.suffix ?? null, command: tag?.command ?? null };
+  }
   // Only an absolute path is a territory question. A relative or malformed
   // detail means the line was not what it looked like; dropping beats guessing.
   if (!deny.detail.startsWith("/")) return null;
@@ -367,7 +411,7 @@ export function scopeOf(settings, root) {
  * logging less than it used to.
  */
 export function watchDenials(onDeny, { pid = null, argv = null, platform = process.platform, spawnFn = spawn, treeFn = processTree, now = () => performance.now() } = {}) {
-  const stats = { attributed: 0, foreign: 0, unattributed: 0 };
+  const stats = { attributed: 0, foreign: 0, unattributed: 0, dropped: 0 };
 
   /**
    * Unavailable is a watcher that does nothing, NOT a different shape.
@@ -391,7 +435,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     return {
       available: false,
       reason: platform === "linux"
-        ? "kernel denials are not readable from outside the runtime on Linux — see docs/upstream/cli-violations.md"
+        ? "kernel denials are not readable from outside the runtime on Linux — see https://github.com/carlostapiacl/seisin/blob/main/docs/upstream/cli-violations.md"
         : `no kernel denial stream on ${platform}`,
       stats,
       attributeTo() {},
@@ -559,6 +603,9 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     while ((cut = buf.indexOf("_SBX")) !== -1) {
       const chunk = buf.slice(0, cut + 4);
       buf = buf.slice(cut + 4);
+      // A marker never contains the tag, so it is whole in one chunk or still
+      // in `buf`, which close() counts.
+      stats.dropped += droppedIn(chunk);
       const d = parseChunk(chunk);
       if (d) d.seen = now();
       // Deduplicated here and not in consider(), because a held denial goes
@@ -567,7 +614,9 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       // pid — which, on a short command, is all of them.
       if (d && !isRepeat(d)) consider(d);
     }
-    if (buf.length > 64_000) buf = "";   // a stream we cannot parse is not a leak
+    // A stream we cannot parse is not a leak. A flooded one is mostly markers
+    // with no tag between them, so they are counted before they go.
+    if (buf.length > 64_000) { stats.dropped += droppedIn(buf); buf = ""; }
   });
   // A monitor that cannot run must never take the run down with it. Same rule
   // as append(): the instrument is allowed to fail, the agent is not.
@@ -604,11 +653,11 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
      */
     close({ drain = 0 } = {}) {
       clearTimeout(recheck);
-      const stop = () => { try { child.kill("SIGTERM"); } catch { /* already gone */ } };
-      if (drain <= 0) { stop(); return Promise.resolve(stats); }
+      const stop = () => ended(child).then(() => { stats.dropped += droppedIn(buf); buf = ""; return stats; });
+      if (drain <= 0) return stop();
       return new Promise((resolve) => {
         let quiet = null;
-        const settle = () => { clearTimeout(quiet); clearTimeout(cap); stop(); resolve(stats); };
+        const settle = () => { clearTimeout(quiet); clearTimeout(cap); resolve(stop()); };
         const cap = setTimeout(settle, drain);
         const bump = () => { clearTimeout(quiet); quiet = setTimeout(settle, QUIET_MS); };
         child.stdout?.on("data", bump);
@@ -618,6 +667,28 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
   };
 }
 
+/**
+ * Stop a `log stream` and wait for what it was still holding.
+ *
+ * SIGINT, not SIGTERM. Writing to a pipe, `log` buffers its own notices — a
+ * denial's line arrives at once, but the "messages dropped" markers were buffered
+ * 8 KB at a time and came out together, measured twelve seconds after the flood
+ * began. SIGINT makes it flush them before it exits; SIGTERM threw them away
+ * (18 markers against 0 in the same flood). Bounded, so a stream that will not
+ * exit cannot hold up the end of a run.
+ */
+function ended(child, cap = END_MS) {
+  return new Promise((resolve) => {
+    if (child.exitCode !== null || child.signalCode !== null) return resolve();
+    const timer = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} resolve(); }, cap);
+    child.once("close", () => { clearTimeout(timer); resolve(); });
+    try { child.kill("SIGINT"); } catch { clearTimeout(timer); resolve(); }
+  });
+}
+
+/** How long a stopped `log stream` gets to flush and exit. */
+const END_MS = 1000;
+
 /**
  * How long the stream has to stay silent before a drain gives up on it.
  *
@@ -658,3 +729,68 @@ const HELD_MAX = 500;
  * `asked 3×` mean anything.
  */
 const REPEAT_MS = 1000;
+
+/**
+ * Is the system log dropping messages right now, and who is writing the most?
+ *
+ * For `seisin check --system-log`. Two streams for `seconds`: one with the run's
+ * own predicate, counting the batches it loses — the number a run would have
+ * seen — and one unfiltered, counting messages by sender, because a flood
+ * comes from somebody and naming them is the only fix there is. A kernel
+ * message is named by its first word, which is the function that wrote it
+ * (`cfil_inp_log`): "kernel" alone names nothing.
+ *
+ * Reads the log and starts no sandbox. Not available off macOS, where denials
+ * are not read from a log at all.
+ */
+export function measureSystemLog({ seconds = 3, platform = process.platform, spawnFn = spawn } = {}) {
+  if (platform !== "darwin") return Promise.resolve({ available: false, reason: `no system log stream on ${platform}` });
+  const streams = [];
+  const start = (args) => {
+    const child = spawnFn("/usr/bin/log", ["stream", ...args], { stdio: ["ignore", "pipe", "ignore"] });
+    child.on("error", () => {});
+    streams.push(child);
+    return child;
+  };
+  return new Promise((resolve) => {
+    let dropped = 0, lines = 0, tail = "", rest = "";
+    const by = new Map();
+    let ours, all;
+    try {
+      ours = start(["--predicate", PREDICATE, "--style", "compact"]);
+      all = start(["--style", "ndjson"]);
+    } catch (e) {
+      for (const c of streams) try { c.kill("SIGTERM"); } catch {}
+      return resolve({ available: false, reason: `could not start the log stream: ${e.message}` });
+    }
+    ours.stdout?.on("data", (d) => {
+      const text = tail + d.toString();
+      const cut = text.lastIndexOf("\n");
+      dropped += droppedIn(text.slice(0, cut + 1));
+      tail = text.slice(cut + 1);
+    });
+    all.stdout?.on("data", (d) => {
+      const parts = (rest + d.toString()).split("\n");
+      rest = parts.pop();
+      for (const line of parts) {
+        if (!line.startsWith("{")) continue;
+        let e;
+        try { e = JSON.parse(line); } catch { continue; }
+        lines++;
+        const proc = basename(String(e.processImagePath ?? "?"));
+        const who = e.subsystem
+          ? `${proc} · ${e.subsystem}`
+          : proc === "kernel" ? `kernel · ${String(e.eventMessage ?? "").split(/[\s:]/)[0] || "?"}` : proc;
+        by.set(who, (by.get(who) ?? 0) + 1);
+      }
+      if (rest.length > 1_000_000) rest = "";
+    });
+    setTimeout(async () => {
+      await Promise.all(streams.map((c) => ended(c)));
+      dropped += droppedIn(tail);
+      const top = [...by].sort((a, b) => b[1] - a[1]).slice(0, 3)
+        .map(([who, n]) => ({ who, perSecond: Math.round(n / seconds) }));
+      resolve({ available: true, seconds, dropped, perSecond: Math.round(lines / seconds), top });
+    }, seconds * 1000);
+  });
+}

package/src/walls.js

@@ -31,11 +31,12 @@
  * its wall disappear on the next turn instead of two days later.
  *
  * A window is still accepted, and still useful for a different reason: a
- * refusal from three weeks ago is noise even if it is still refused today.
+ * denial from three weeks ago is noise even if it is still denied today.
  */
 import { read, readEntries } from "./log.js";
 import { explain } from "./owners.js";
 import { STALE_RUNS, RUN_GAP_MS, runsAfter } from "./requests.js";
+import { expectedOf } from "./kinds.js";
 
 /** A wall is something you hit more than once. Once is information; twice is a pattern. */
 export const MIN_HITS = 2;
@@ -51,9 +52,11 @@ export const MIN_HITS = 2;
 export function walls(config, role, { file, entries = null, min = MIN_HITS, since = null, limit = 6, fresh = false, ask = explain } = {}) {
   // `entries`: the log already read, for a caller asking about every role at
   // once (the console asks for 32 on a real policy) — one read instead of 32.
-  const denied = entries
+  // Less the caller's own probes (`seisin run --expect-denied`): denied as
+  // whoever started the run asked, and not a wall the role keeps hitting.
+  const denied = (entries
     ? entries.filter((e) => e.role === role && e.verdict === "denied" && (!since || e.at >= since))
-    : read(file, { role, verdict: "denied", ...(since ? { since } : {}) });
+    : read(file, { role, verdict: "denied", ...(since ? { since } : {}) })).filter((e) => e.expected !== true);
 
   const byKey = new Map();
   for (const e of denied) {
@@ -73,7 +76,10 @@ export function walls(config, role, { file, entries = null, min = MIN_HITS, sinc
     // about every role at once.
     const verdict = ask(config, role, w.action, w.target);
     if (verdict.allowed) continue;
-    out.push({ ...w, reason: verdict.reason, owners: verdict.owners });
+    // Refused correctly and nothing to do about it (kinds.js expectedOf): kept,
+    // and marked, so a screen says it apart instead of as a role stuck.
+    const expected = expectedOf(w.target);
+    out.push({ ...w, reason: verdict.reason, owners: verdict.owners, ...(expected && { expected }) });
   }
   // A wall the role stopped hitting — it ran STALE_RUNS times since, refused
   // elsewhere but not here — is still true and no longer worth saying. Same
@@ -115,14 +121,56 @@ const TAIL_BYTES = 4 * 1024 * 1024;
  * call.
  */
 export function timesHit(file, role, action, target) {
+  return hitsOf(file, role, action, target).total;
+}
+
+/**
+ * The same count, and how much of it is this run's.
+ *
+ * Denial lines carry no run id; each run's canary does, and comes first. So
+ * `inRun` counts from the canary of `run` (SEISIN_RUN_ID) onwards, and is null
+ * when that canary is not in the tail — outside `seisin run`, or a run older
+ * than the tail. Measured: a fresh run told "denied 5 times now" about its
+ * first try read as a counter gone wrong; the five were from earlier runs.
+ */
+export function hitsOf(file, role, action, target, run = null) {
   // The line the tail cut lands in is dropped (readLines checks the byte before
   // the cut, so a cut on a boundary keeps it). Comparing the file's byte size
   // with the text's UTF-16 length used to decide that, and with any multibyte
   // character in the tail it kept the fragment of a line or dropped a whole one.
-  let n = 0;
-  for (const e of readEntries(file, { tail: TAIL_BYTES }))
-    if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) n++;
-  return n;
+  const id = run ? String(run).slice(0, 8) : null;
+  let total = 0, inRun = null;
+  for (const e of readEntries(file, { tail: TAIL_BYTES })) {
+    if (id && e.event === "canary" && e.role === role && e.run === id) inRun = 0;
+    if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) {
+      total++;
+      if (inRun !== null) inRun++;
+    }
+  }
+  return { total, inRun };
+}
+
+/**
+ * The sentence about having been denied this before, or "".
+ *
+ * `times` and `inRun` include the attempt being answered. Said about this run
+ * when the run is known, and earlier runs are named as earlier runs. Silent on
+ * a first time anywhere.
+ */
+export function againWords({ times, inRun = null }) {
+  if (inRun === null)
+    return times > 1 ? ` You have been denied this ${times} times now; it is not going to work on the ${ordinal(times + 1)} try.` : "";
+  const earlier = times - inRun;
+  if (inRun > 1)
+    return ` You have been denied this ${inRun} times in this run` + (earlier > 0 ? ` (and ${earlier} in earlier runs)` : "") +
+      `; it is not going to work on the ${ordinal(inRun + 1)} try.`;
+  return earlier > 0 ? ` It was denied ${earlier} time(s) in earlier runs too; this run gets the same answer.` : "";
+}
+
+/** 4 -> "fourth". Past a handful the numeral reads better than the word. */
+export function ordinal(n) {
+  const words = ["", "first", "second", "third", "fourth", "fifth", "sixth", "seventh", "eighth", "ninth", "tenth"];
+  return words[n] ?? `${n}th`;
 }
 
 /**
@@ -132,7 +180,9 @@ export function timesHit(file, role, action, target) {
  * one after that is the cost of not having been able to remember.
  */
 export function wasted(list) {
-  return list.reduce((n, w) => n + w.times - 1, 0);
+  // An expected refusal is the agent program's own housekeeping, not a call
+  // the agent spent retrying.
+  return list.reduce((n, w) => n + (w.expected ? 0 : w.times - 1), 0);
 }
 
 /**
@@ -143,6 +193,9 @@ export function wasted(list) {
  * whole section — and then the one turn it matters, it is skipped too.
  */
 export function render(list) {
+  // Not the agent's to stop retrying: Claude Code's plugin updater is not a
+  // tool call, so telling the agent about it is a line it can do nothing with.
+  list = list.filter((w) => !w.expected);
   if (!list.length) return "";
   const lines = [
     "WALLS — you have already been denied these, and the policy still denies them.",